Palo Alto Networks PAN-XDRA Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-XDRA Online Questions & Answers

• Question 31:

  A file is identified as malware by the Local Analysis module whereas WildFire verdict is Benign, Assuming WildFire is accurate.

  Which statement is correct for the incident?

  A. It is true positive.
  B. It is false positive.
  C. It is a false negative.
  D. It is true negative.
  B. It is false positive.

  ---

  Explanation

  A false positive is a situation where a file or activity is incorrectly identified as malicious by a security tool, when in fact it is benign or harmless. A false positive can cause unnecessary alerts, disruptions, or remediation actions, and reduce the confidence and efficiency of the security system. In this question, a file is identified as malware by the Local Analysis module, whereas WildFire verdict is Benign, assuming WildFire is accurate. This means that the Local Analysis module has made a mistake and flagged a legitimate file as malicious, while WildFire has correctly determined that the file is safe. Therefore, this is an example of a false positive. The Local Analysis module is a feature of the Cortex XDR agent that uses a static set of pattern-matching rules and a statistical model to determine if an unknown file is likely to be malware. The Local Analysis module can provide a fast and offline verdict for files that are not yet analyzed by WildFire, but it is not as accurate or comprehensive as WildFire, which uses dynamic analysis and machine learning to examine the behavior and characteristics of files in a sandbox environment. WildFire verdicts are considered more reliable and authoritative than Local Analysis verdicts, and can override them in case of a discrepancy. Therefore, if a file is identified as malware by the Local Analysis module, but as Benign by WildFire, the WildFire verdict should be trusted and the Local Analysis verdict should be disregarded123

  False positive (security) - Wikipedia Local Analysis

  WildFire Overview

• Question 32:

  Which of the following represents a common sequence of cyber-attack tactics?

  A. Actions on the objective >> Reconnaissance >> Weaponization & Delivery >> Exploitation >> Installation >> Command & Control
  B. Installation >> Reconnaissance >> Weaponization & Delivery >> Exploitation >> Command & Control >> Actions on the objective
  C. Reconnaissance >> Weaponization & Delivery >> Exploitation >> Installation >> Command & Control >> Actions on the objective
  D. Reconnaissance >> Installation >> Weaponization & Delivery >> Exploitation >> Command & Control >> Actions on the objective
  C. Reconnaissance >> Weaponization & Delivery >> Exploitation >> Installation >> Command & Control >> Actions on the objective

  ---

  Explanation

  A common sequence of cyber-attack tactics is based on the Cyber Kill Chain model, which describes the stages of a cyber intrusion from the perspective of the attacker. The Cyber Kill Chain model consists of seven phases: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on the objective. These phases are briefly explained below:

  Reconnaissance: The attacker gathers information about the target, such as its network, systems, vulnerabilities, employees, and business operations. The attacker may use various methods, such as scanning, phishing, or searching open sources, to collect data that can help them plan the attack.

  Weaponization: The attacker creates or obtains a malicious payload, such as malware, exploit, or script, that can be used to compromise the target. The attacker may also embed the payload into a delivery mechanism, such as an email attachment, a web link, or a removable media.

  Delivery: The attacker sends or delivers the weaponized payload to the target, either directly or indirectly. The attacker may use various channels, such as email, web, or physical access, to reach the target's network or system.

  Exploitation: The attacker exploits a vulnerability or weakness in the target's network or system to execute the payload. The vulnerability may be technical, such as a software flaw, or human, such as a social engineering trick.

  Installation: The attacker installs or drops additional malware or tools on the target's network or system to establish a foothold and maintain persistence. The attacker may use various techniques, such as registry modification, file manipulation, or process injection, to hide their presence and evade detection.

  Command and Control: The attacker establishes a communication channel between the compromised target and a remote server or controller. The attacker may use various protocols, such as HTTP, DNS, or IRC, to send commands and receive data from the target.

  Actions on the objective: The attacker performs the final actions that achieve their goal, such as stealing data, destroying files, encrypting systems, or disrupting services. The attacker may also try to move laterally within the target's network or system to access more resources or data.

  Cyber Kill Chain: This document explains the Cyber Kill Chain model and how it can be used to analyze and respond to cyberattacks.

  Cyber Attack Tactics: This document provides an overview of some common cyber attack tactics and examples of how they are used by threat actors.

• Question 33:

  When viewing the incident directly, what is the "assigned to" field value of a new Incident that was just reported to Cortex?

  A. Pending
  B. It is blank
  C. Unassigned
  D. New
  C. Unassigned

  ---

  Explanation

  The "assigned to" field value of a new incident that was just reported to Cortex is "Unassigned". This means that the incident has not been assigned to any analyst or group yet, and it is waiting for someone to take ownership of it. The "assigned to" field is one of the default fields that are displayed in the incident layout, and it can be used to filter and sort incidents in the incident list. The "assigned to" field can be changed manually by an analyst, or automatically by a playbook or a rule 12. Let's briefly discuss the other options to provide a comprehensive explanation:

  A. Pending: This is not the correct answer. Pending is not a valid value for the "assigned to" field. Pending is a possible value for the "status" field, which indicates the current state of the incident. The status field can have values such as "New", "Active", "Done", "Closed", or "Pending"3.

  B. It is blank: This is not the correct answer. The "assigned to" field is never blank for any incident. It always has a default value of "Unassigned" for new incidents, unless a playbook or a rule assigns it to a specific analyst or group12.

  D. New: This is not the correct answer. New is not a valid value for the "assigned to" field. New is a possible value for the "status" field, which indicates the current state of the incident. The status field can have values such as "New", "Active", "Done", "Closed", or "Pending"3. In conclusion, the "assigned to" field value of a new incident that was just reported to Cortex is "Unassigned". This field can be used to manage the ownership and responsibility of incidents, and it can be changed manually or automatically. Cortex XDR Pro Admin Guide: Manage Incidents Cortex XDR Pro Admin Guide: Assign Incidents Cortex XDR Pro Admin Guide: Update Incident Status

• Question 34:

  What are two purposes of "Respond to Malicious Causality Chains" in a Cortex XDR Windows Malware profile? (Choose two.)

  A. Automatically close the connections involved in malicious traffic.
  B. Automatically kill the processes involved in malicious activity.
  C. Automatically terminate the threads involved in malicious activity.
  D. Automatically block the IP addresses involved in malicious traffic.
  B. Automatically kill the processes involved in malicious activity.
  D. Automatically block the IP addresses involved in malicious traffic.

  ---

  Explanation

  The "Respond to Malicious Causality Chains" feature in a Cortex XDR Windows Malware profile allows the agent to take automatic actions against network connections and processes that are involved in malicious activity on the endpoint. The feature has two modes: Block IP Address and Kill Process1. The two purposes of "Respond to Malicious Causality Chains" in a Cortex XDR Windows Malware profile are: Automatically kill the processes involved in malicious activity. This can help to stop the malware from spreading or doing any further damage.

  Automatically block the IP addresses involved in malicious traffic. This can help to prevent the malware from communicating with its command and control server or other malicious hosts. The other two options, automatically close the connections involved in malicious traffic and automatically terminate the threads involved in malicious activity, are not specific to "Respond to Malicious Causality Chains". They are general security measures that the agent can perform regardless of the feature.

  Cortex XDR Agent Security Profiles

  Cortex XDR Agent 7.5 Release Notes PCDRA: What are purposes of "Respond to Malicious Causality Chains" in ...

• Question 35:

  What is the action taken out by Managed Threat Hunting team for Zero Day Exploits?

  A. MTH researches for threats in the tenant and generates a report with the findings.
  B. MTH researches for threats in the logs and reports to engineering.
  C. MTH runs queries and investigative actions and no further action is taken.
  D. MTH pushes content updates to prevent against the zero-day exploits.
  A. MTH researches for threats in the tenant and generates a report with the findings.

  ---

  Explanation

  The Managed Threat Hunting (MTH) team is a group of security experts who proactively hunt for threats in the Cortex XDR tenant and generate a report with the findings. The MTH team uses advanced queries and investigative actions to identify and analyze potential threats, such as zero-day exploits, that may have bypassed the prevention and detection capabilities of Cortex XDR. The MTH team also provides recommendations and best practices to help customers remediate the threats and improve their security posture. References Managed Threat Hunting Service Managed Threat Hunting Report

• Question 36:

  When investigating security events, which feature in Cortex XDR is useful for reverting the changes on the endpoint?

  A. Remediation Automation
  B. Machine Remediation
  C. Automatic Remediation
  D. Remediation Suggestions
  D. Remediation Suggestions

  ---

  Explanation

  When investigating security events, the feature in Cortex XDR that is useful for reverting the changes on the endpoint is Remediation Suggestions. Remediation Suggestions are a feature of Cortex XDR that provide you with recommended actions to undo the effects of malicious activity on your endpoints. You can view the remediation suggestions for each alert or incident in the Cortex XDR console, and decide whether to apply them or not. Remediation Suggestions can help you restore the endpoint to its original state, remove malicious files or processes, or fix registry or system settings. Remediation Suggestions are based on the forensic data collected by the Cortex XDR agent and the analysis performed by Cortex XDR.

  References

  Remediation Suggestions

  Apply Remediation Suggestions

• Question 37:

  Which of the following protocols is primarily used for secure communication between the Cortex XDR agent and the management console?

  A. HTTP
  B. HTTPS
  C. WSS
  D. FTP
  C. WSS

  ---

  Explanation

  WSS (WebSocket Secure) is used for maintaining a secure, bidirectional communication channel between the Cortex XDR agent and the management console, providing efficient incident response and data sharing. Option A and B are used for one-way communication, while FTP is for file transfers, not for agent-console communication.

• Question 38:

  Network attacks follow predictable patterns. If you interfere with any portion of this pattern, the attack will be neutralized.

  Which of the following statements is correct?

  A. Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the firewall.
  B. Cortex XDR Analytics does not interfere with the pattern as soon as it is observed on the endpoint.
  C. Cortex XDR Analytics does not have to interfere with the pattern as soon as it is observed on the endpoint in order to prevent the attack.
  D. Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the endpoint.
  D. Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the endpoint.

  ---

  Explanation

  Cortex XDR Analytics is a cloud-based service that uses machine learning and artificial intelligence to detect and prevent network attacks. Cortex XDR Analytics can interfere with the attack pattern as soon as it is observed on the endpoint by applying protection policies that block malicious processes, files, or network connections. This way, Cortex XDR Analytics can stop the attack before it causes any damage or compromises the system. References [Cortex XDR Analytics Overview] [Cortex XDR Analytics Protection Policies]

• Question 39:

  Where can SHA256 hash values be used in Cortex XDR Malware Protection Profiles?

  A. in the macOS Malware Protection Profile to indicate allowed signers
  B. in the Linux Malware Protection Profile to indicate allowed Java libraries
  C. SHA256 hashes cannot be used in Cortex XDR Malware Protection Profiles
  D. in the Windows Malware Protection Profile to indicate allowed executables
  D. in the Windows Malware Protection Profile to indicate allowed executables

  ---

  Explanation

  Cortex XDR Malware Protection Profiles allow you to configure the malware prevention settings for Windows, Linux, and macOS endpoints. You can use SHA256 hash values in the Windows Malware Protection Profile to indicate allowed executables that you want to exclude from malware scanning. This can help you reduce false positives and improve performance by skipping the scanning of known benign files. You can add up to 1000 SHA256 hash values per profile. You cannot use SHA256 hash values in the Linux or macOS Malware Protection Profiles, but you can use other criteria such as file path, file name, or signer to exclude files from scanning. References Malware Protection Profiles Configure a Windows Malware Protection Profile PCDRA Study Guide

• Question 40:

  Which engine, of the following, in Cortex XDR determines the most relevant artifacts in each alert and aggregates all alerts related to an event into an incident?

  A. Sensor Engine
  B. Causality Analysis Engine
  C. Log Stitching Engine
  D. Causality Chain Engine
  B. Causality Analysis Engine

  ---

  Explanation

  The engine that determines the most relevant artifacts in each alert and aggregates all alerts related to an event into an incident is the Causality Analysis Engine. The Causality Analysis Engine is one of the core

  components of Cortex XDR that performs advanced analytics on the data collected from various sources, such as endpoints, networks, and clouds. The Causality Analysis Engine uses machine learning and behavioral analysis to identify the root cause, the attack chain, and the impact of each alert. It also groups related alerts into incidents based on the temporal and logical relationships among the alerts. The Causality Analysis Engine helps to reduce the noise and complexity of alerts and incidents, and provides a clear and concise view of the attack story 12.

  Let's briefly discuss the other options to provide a comprehensive explanation:

  A. Sensor Engine: This is not the correct answer. The Sensor Engine is not responsible for determining the most relevant artifacts in each alert and aggregating all alerts related to an event into an incident. The Sensor Engine is the component that runs on the Cortex XDR agents installed on the endpoints. The Sensor Engine collects and analyzes endpoint data, such as processes, files, registry keys, network connections, and user activities. The Sensor Engine also enforces the endpoint security policies and performs prevention and response actions3.

  C. Log Stitching Engine: This is not the correct answer. The Log Stitching Engine is not responsible for determining the most relevant artifacts in each alert and aggregating all alerts related to an event into an incident. The Log Stitching Engine is the component that runs on the Cortex Data Lake, which is the cloud-based data storage and processing platform for Cortex XDR. The Log Stitching Engine normalizes and stitches together the data from different sources, such as firewalls, proxies, endpoints, and clouds. The Log Stitching Engine enables Cortex XDR to correlate and analyze data from multiple sources and provide a unified view of the network activity and threat landscape4.

  D. Causality Chain Engine: This is not the correct answer. Causality Chain Engine is not a valid name for any of the Cortex XDR engines. There is no such engine in Cortex XDR that performs the function of determining the most relevant artifacts in each alert and aggregating all alerts related to an event into an incident. In conclusion, the Causality Analysis Engine is the engine that determines the most relevant artifacts in each alert and aggregates all alerts related to an event into an incident. By using the Causality Analysis Engine, Cortex XDR can provide a comprehensive and accurate detection and response capability for security analysts. Cortex XDR Pro Admin Guide: Causality Analysis Engine Cortex XDR Pro Admin Guide: View Incident Details Cortex XDR Pro Admin Guide: Sensor Engine Cortex XDR Pro Admin Guide: Log Stitching Engine